← All checklists
SOC 2 readiness checklist
Every SOC 2 Trust Services Criterion a service organization has to act on, mapped to its criterion ID, with the evidence an auditor will ask for. Preview 11 of the 66 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers SOC 2 2017 TSC (2022 points of focus)Reviewed 30 Oct 202666 items · 10 sections
Scope and approach
5 items
- Prep 1Decide between a Type I report (design at a point in time) and a Type II report (operating effectiveness over a period, usually 3 to 12 months).Evidence: Engagement letter or audit plan stating the report type and period.
CC1. Control environment
5 items
- CC1.1Publish a code of conduct, have staff and contractors acknowledge it, and act on breaches.Evidence: Code of conduct, signed acknowledgements, disciplinary records.
CC2 and CC3. Communication and risk assessment
7 items
- CC2.1Collect and use accurate, timely information to run and monitor internal controls, such as asset inventories and system logs.Evidence: Asset inventory, data flow diagrams, monitoring dashboards.
CC4 and CC5. Monitoring and control activities
5 items
- CC4.1Evaluate whether controls are working through ongoing monitoring and periodic reviews, audits or penetration tests.Evidence: Internal audit or control testing results, pen test report.
CC6. Logical and physical access
8 items
- CC6.1Control logical access with SSO, MFA, an asset inventory, network segmentation and encryption of sensitive data.Evidence: IdP and MFA settings, encryption configuration, asset inventory.
CC7 to CC9. Operations, change and risk mitigation
8 items
- CC7.1Detect configuration drift and new vulnerabilities with scanning and monitoring, and fix findings on a defined timeline.Evidence: Vulnerability scan results and remediation SLA tracking.
Availability and Confidentiality (if in scope)
5 items
- A1.1Monitor capacity and usage so you can add resources before demand affects availability commitments.Evidence: Capacity dashboards, autoscaling settings, capacity reviews.
Processing Integrity (if in scope)
5 items
- PI1.1Define and share specifications for the data your system processes and the outputs it should produce.Evidence: Data definitions and product specifications.
Privacy: notice, consent, collection and use (if in scope)
7 items
- P1.1Give people a clear privacy notice about what you collect, why, and how they can exercise their rights.Evidence: Published privacy notice with version history.
Privacy: access, disclosure, quality and complaints (if in scope)
11 items
- P5.1Let people access the personal information you hold about them after verifying who they are.Evidence: Data subject request procedure and fulfilled request log.
- P5.2Let people correct their personal information and pass corrections on to third parties where needed.Evidence: Correction requests and update records.
Changelog
- v1.030 Oct 2026First release. Covers the 2017 Trust Services Criteria with the 2022 revised points of focus, for Security and the optional categories.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.